2026-06-10-c84347b2

• Coverage window: standard daily, 36 h (gap to prior brief 2026-06-09 = 24 h). No catch-up extension needed.
• Immediate Action callout intentionally omitted. Ivanti Sentry CVE-2026-10520 (CVSS 10.0 pre-auth RCE, public PoC today) was the strongest candidate but has no confirmed in-the-wild exploitation or verified mass-scanning yet; per the callout bar ("if unsure, omit"), its urgency is surfaced in § 0 TL;DR, § 2 and § 6 instead.
• Single-source items (named): § 3 Unit 42 cloud-logging defense-evasion, § 3 Red Canary Entra Agent ID OBO abuse, and § 3 Check Point TDS ecosystem are each single HIGH-reliability vendor primary research (flagged [SINGLE-SOURCE] in-heading). § 1 NCSC-CH Week 23 and § 4 CRA deadline are single-source national-CERT / EU-authority primary disclosures (PD-5 carve-out). § 5 Dragos Q1 2026 is single-source HIGH-reliability OT/ICS specialist research; victim attributions trace to Dragos.
• Reduced confidence — aggregator-only sourcing: the § 1 Meta Instagram item rests on BleepingComputer and Security Affairs, which both relay Meta's Maine AG breach filing; the regulator filing is the underlying primary but was not directly retrievable in this run. Treat the 20,225 figure and the logic-flaw description as accurately relayed but not independently fetched from the filing.
• Vendor-primary single-source CVE items: the Ivanti Sentry (CVE-2026-10520, watchTowr), Chrome V8 (CVE-2026-11645, Chrome Releases) and Arista EOS (CVE-2026-7473, Arista advisory) items each cite a single authoritative vendor/research primary; the Chrome and Arista entries are independently corroborated by their CISA KEV listing (the KEV catalog root is a hard-blocked Source URL, so it is referenced in prose rather than the footer).
• Disclosure-only vulnerabilities (no confirmed ITW), included for CH/EU patch-prioritisation relevance: CVE-2026-47895 (strongSwan), CVE-2026-44963 (Veeam, authenticated), the SAP June notes, and the TYPO3 batch. Of today's § 2 CVEs only CVE-2026-11645 (Chrome) and CVE-2026-7473 (Arista) are KEV-listed/exploited; CVE-2026-10520 has a public PoC but no observed ITW. Patch-Tuesday CVEs not meeting the § 2 bar individually (e.g. CVE-2026-45586 CTFMON EoP) are referenced only as cluster context, not promoted to standalone items.
• Gamaredon long-running-campaign rule: the Trend Micro WinRAR report (§ 3) is framed around the novel UAC-0226/GIFTEDCROOK and Earth Dahu angle and CVE-2025-8088 persistence, not a re-summary of the Gamaredon GammaPhish/GammaWorm/GammaSteel chain already covered 2026-06-02→2026-06-08 and in the W23 weekly.
• Unverified actor claims flagged in-text: the Tchap attacker's directory-search enumeration method, the broader scrape figures (~643k messages, ~13.5 GB media) and the alleged unauthenticated media-retrieval bug are all attributed to the unverified actor (and reported by The Register as unverified claims), not stated as confirmed; DINUM's confirmed scope (73,467 agents; name/first-name/email/employing-entity/avatar) is what the brief reports as fact.
• Contradictions: none material. Microsoft June CVE count is reported as 198 (Rapid7/Tenable enumeration); SANS ISC cites 204/38-critical and Microsoft's own roll-up differs slightly by counting methodology and Chromium inclusion — the brief uses the Rapid7/Tenable figure and notes the methodology gap rather than asserting a single count.
• Sub-agents: all four (S1–S4, Claude Sonnet 4.6) returned within budget. New candidate source surfaced and added this run: InfoGuard Labs (labs.infoguard.ch), status candidate — the Ghost-Sender disclosing party. Socket.dev and Resecurity were also surfaced as candidates but held over (one-candidate-per-run cap).
• Coverage gaps: databreaches-net (bridge HTTP 403 + Wayback placeholder only — 7th consecutive run failure, transport block not demotion); sec-disclosures-edgar (HTTP 500 on the 5–10 June range, narrower 9–10 June range returned 0 qualifying Item 1.05 filings); sophos-xops (HTTP 503, 6th consecutive run — transport block); greynoise (no usable RSS/bridge endpoint — Webflow SPA); trendmicro-research (article body JS-rendered; WinRAR story corroborated via The Hacker News); cert-fr-actualite (weekly-bulletin feed stale to 2025, avis current but no in-window additions). inside-it-ch RSS bridge route confirmed working this run (resolves the prior 404 gap); no in-window security incidents on the feed.

Unmatched action items (migrated)

• Close Ghost-Sender on Exchange Online tenants using a third-party MX — there is no vendor patch: add a Partner/On-premises inbound connector requiring the gateway's TLS certificate or approved IPs, add a priority-0 transport rule rejecting mail not arriving via that connector, and verify Enhanced Filtering for Connectors is enabled. Hunt Message Trace for inbound mail on the Default Frontend connector. See § 1.
• Harden the IT/OT boundary against ransomware — deny RMM tooling (AnyDesk, SimpleHelp, Atera, N-able, ScreenConnect) by default on OT-adjacent hosts and alert on execution; extend access controls to ICS engineering/integration vendors' remote paths. See § 5.
• Audit developer and research endpoints for the Hades PyPI wave — hunt *-setup.pth creation under site-packages and Bun downloads from github.com/oven-sh/bun; pin dependencies and install with --ignore-scripts. See § 4.

Migrated from briefs/2026-06-10.md (v2).